Twisted: Denial of service via IRC buffer exhaustion (CVE-2026-115776)

Twisted versions prior to 26.10.0rc1 are vulnerable to a denial of service (DoS) condition in the twisted.words.protocols.irc.IRC.dataReceived method. The component fails to enforce maximum line lengths or clear per-connection buffers for data received without line feeds. This behavior is inherited by the twisted.words.service.IRCUser server subclass. Because the buffering occurs prior to authentication commands, an unauthenticated attacker can connect to an IRC service and send a continuous stream of bytes to deplete available memory, causing the server process to crash and affecting all users.

Impact

Successful exploitation leads to memory exhaustion and total denial of service for the target IRC server process. This is a remote, unauthenticated vulnerability that does not require login credentials to execute.

Recommendation

• Upgrade the Twisted framework to version 26.10.0rc1 or later immediately.
• If upgrading is not immediately possible, implement edge protection to rate-limit or drop unauthorized IRC connections.
• Review server resource utilization monitoring for anomalous memory growth trends in applications utilizing the twisted.words IRC modules.